CVE-2022-0580: Improper Access Control in librenms
Summary
CVE-2022-0580: Improper Access Control in librenms. Affects librenms/librenms versions < 22.2.0. Fixed in 22.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LibreNMS is an open-source network monitoring tool that provides comprehensive monitoring and alerting for networks of all sizes. It offers features such as automatic discovery, device polling, and graphing of network metrics. However, prior to version 22.2.0, LibreNMS was vulnerable to an improper access control issue.
Vulnerability Detail
The vulnerability in LibreNMS allows unauthorized users to gain access to sensitive information or perform actions that should be restricted. This can lead to unauthorized access to network devices, data leaks, or even complete compromise of the monitored network. The vulnerability is rated as HIGH severity with a CVSS score of 7.1.
How To Fix
Minimum fixed version
22.2.0
This is the first release that contains the fix.
composer require librenms/librenms:22.2.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version as soon as possible to ensure the security of your network monitoring infrastructure.
Conclusion
In conclusion, the improper access control vulnerability in LibreNMS prior to version 22.2.0 can lead to unauthorized access and potential compromise of the monitored network. It is crucial to upgrade to the fixed version to ensure the security of your network monitoring infrastructure. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for librenms/librenms →
FAQ
The vulnerability allows unauthorized users to gain access to sensitive information or perform restricted actions, potentially leading to unauthorized access to network devices, data leaks, or complete compromise of the monitored network.
No, only versions prior to 22.2.0 are affected. It is recommended to upgrade to the latest version to ensure the security of your LibreNMS installation.
At the time of this advisory, there is no known public exploit for this vulnerability. However, it is important to apply the necessary patches and upgrades to mitigate the risk.
Yes, this vulnerability can be exploited remotely by unauthorized users. It is crucial to upgrade to the fixed version to prevent potential attacks.
You can find more information about this vulnerability, including the technical details and the CVE identifier, on the official GitHub Advisory Database page: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-33wf-4crm-2322/GHSA-33wf-4crm-2322.json
Related vulnerabilities
Recent vulnerabilities recorded for librenms/librenms.
